From 1f0a664a4f06551af8c8533c14a67321173de463 Mon Sep 17 00:00:00 2001
From: Djeex <djeex@djeex.fr>
Date: Sat, 22 Aug 2026 15:23:23 +0200
Subject: [PATCH] Pin Python to a patch version and auto-bump build version on
 container changes

---
 .gitea/workflows/ci.yml | 24 +++++++++++++++++++++++-
 Dockerfile              |  2 +-
 2 files changed, 24 insertions(+), 2 deletions(-)

diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml
index 07d92dd..15eadbe 100644
--- a/.gitea/workflows/ci.yml
+++ b/.gitea/workflows/ci.yml
@@ -81,13 +81,35 @@ jobs:
             exit 0
           fi
 
-          IMAGE=git.djeex.fr/djeex/adguard-cidre
+          if echo "$CHANGED" | grep -qE '^VERSION$'; then
+            echo "VERSION was manually edited in this push, using it as-is."
+          else
+            echo "VERSION untouched but container files changed, auto-bumping the build number (Z)."
+            OLD_VERSION=$(tr -d '[:space:]' < VERSION)
+            IFS='.' read -r MAJOR MINOR PATCH <<< "$OLD_VERSION"
+            NEW_VERSION="${MAJOR}.${MINOR}.$((PATCH + 1))"
+            echo "$NEW_VERSION" > VERSION
+
+            git config user.name "adguard-cidre-ci"
+            git config user.email "ci@git.djeex.fr"
+            git add VERSION
+            git commit -m "Bump build version to $NEW_VERSION [skip ci]"
+
+            git push "https://Djeex:${{ secrets.CI_PUSH_TOKEN }}@git.djeex.fr/Djeex/adguard-cidre.git" HEAD:main
+          fi
+
           VERSION=$(tr -d '[:space:]' < VERSION)
+          IFS='.' read -r MAJOR MINOR PATCH <<< "$VERSION"
+          MINOR_TAG="${MAJOR}.${MINOR}"
+
+          IMAGE=git.djeex.fr/djeex/adguard-cidre
           echo "${{ secrets.REGISTRY_TOKEN }}" | docker login git.djeex.fr -u Djeex --password-stdin
 
           # Retag the already-built, already-scanned image — never rebuild for publish,
           # so what ships is byte-for-byte what Trivy just scanned.
           docker tag adguard-cidre:ci "$IMAGE:latest"
+          docker tag adguard-cidre:ci "$IMAGE:$MINOR_TAG"
           docker tag adguard-cidre:ci "$IMAGE:$VERSION"
           docker push "$IMAGE:latest"
+          docker push "$IMAGE:$MINOR_TAG"
           docker push "$IMAGE:$VERSION"
\ No newline at end of file
diff --git a/Dockerfile b/Dockerfile
index 3961f12..d451cea 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,4 +1,4 @@
-FROM python:3.14-alpine AS base
+FROM python:3.14.7-alpine AS base
 
 ENV TZ=Europe/Paris